I have set A of passwords created under policy A and set B of passwords created under policy B. Maximum password length in both conditions is 15. The number of passwords in each set is nearly 70.
I found that 50% passwords in set A are of length 8 and no password in set A has length 11 and 13.
While in set B passwords length vary from 8 to 15. The proportion of passwords in set B having length 8 to 15 doesn't seem to vary much.
Clearly the password length created with policy B is relatively unpredictable.
How do I capture this intuition more formally. Is there any statistical measure to do so? I have the password length distribution for set A as well as set B.
Performing Chi square test of independence with null hypothesis "passwords created under policy A and policy B has no effect on the resulting password length" will reject the null hypothesis. Am I right?
Also if the policies has effect on password length, policy B seems to create more secure passwords, since in this case the proportion of passwords belonging to different lengths are somewhat similar. How do I capture this intuition?